5 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Johan LEROYandClaude Opus 4.7	88ac8870f4	ci: add Gitea Actions tests workflow (check + vitest + build) ... Tourne sur push main/dev et pull_request. Runner node:22-bullseye. Pas de deploy automatique : l'upload FTP reste manuel. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-13 16:12:56 +02:00
Johan LEROYandClaude Opus 4.7	7327959e9e	chore: harden security, clean deps, add vitest baseline ... - .env.example: vider les secrets (à rotater côté Plesk) - src/lib/auth.ts: fail-fast lazy si ADMIN_JWT_SECRET < 32 chars - src/pages/api/upload.ts: retirer .svg (anti-XSS) + try/catch FS - src/pages/api/content/[section].ts: masquer err.message (sauf ZodError) - retirer gsap/three/@types/three/@react-three/{fiber,drei}/lucide-react - bump astro 6.1.10 (GHSA-xr5h-phrj-8vxv) - zod 4: z.email()/z.url() au lieu de .email()/.url() - nettoyer vars inutilisées + Header script is:inline Vitest (38 tests, 615ms): - tests/lib/auth.test.ts: verifyPassword + verifySession (round-trip, secrets distincts) - tests/lib/content.test.ts: load/save + comportement seed - tests/api/files.test.ts: path traversal (../, /, imbriqué) + 200 - tests/api/upload.test.ts: extension/taille/sanitize folder + bucket - tests/middleware.test.ts: gating admin pages vs APIs vs routes publiques - astro check: 0 errors / 0 warnings / 0 hints Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-13 16:07:05 +02:00
Johan LEROY	859683b624	prod setup	2026-05-04 12:05:08 +02:00
Johan LEROY	5d05cd4c04	prod setup	2026-05-04 11:00:44 +02:00
Johan LEROY	7c7ff160eb	first commit	2026-04-21 14:14:03 +02:00